Technique ID,Detection Available,Link,score
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,64
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,55
T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/single_letter_process_on_endpoint.yml,55
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_application_spawn_rundll32_process.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_creating_schedule_task.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_executing_macro_code.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_document_spawned_child_process_to_download.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_bitsadmin.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_certutil.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_mshta.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_rundll32_with_no_dll.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/office_product_spawning_wmic.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_cmd.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_powershell.yml,46
T1566.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/winword_spawning_windows_script_host.yml,46
T1193,No,-,58
T1598.002,No,-,58
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,54
T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,54
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadfile.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/any_powershell_downloadstring.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___execution_policy_bypass.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process_with_obfuscation_techniques.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/nishang_powershelltcponeline.yml,46
T1059.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml,46
T1086,No,-,55
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,48
T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,48
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1060,No,-,45
T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,44
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1071.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_web_traffic_to_dynamic_domain_providers.yml,41
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1192,No,-,37
T1566.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_creating_lnk_file_in_suspicious_location.yml,36
T1598.003,No,-,37
T1107,No,-,37
T1070.004,No,-,37
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/scheduled_task_deleted_or_created_via_cmd.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_scheduling_job_on_remote_system.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/schtasks_used_for_forcing_a_reboot.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_scheduled_task_from_public_directory.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_to_spawn_shell.yml,28
T1053.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/winevent_scheduled_task_created_within_public_path.yml,28
T1083,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,34
T1059.005,No,-,35
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_access_by_provider_user_and_principal.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_saml_update_identity_provider.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_api_calls_from_previously_unseen_user_roles.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_city.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_country.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_ip_address.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_provisioning_from_previously_unseen_region.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_accounts_with_high_risk_roles_by_project.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_high_risk_permissions_by_resource_and_account.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_detect_oauth_token_abuse.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___anomalous_user_clickspeed.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,10
T1078,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,10
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unsigned_image_loaded_by_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/access_lsass_memory_for_dump_creation.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_remote_thread_into_lsass.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_lsass_dump_with_taskmgr.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_credential_dumping_through_lsass_access.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mimikatz_using_loaded_images.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_comsvcs_dll.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump.yml,21
T1003.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/dump_lsass_via_procdump_rename.yml,21
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1036.005,No,-,30
T1016,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml,29
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,28
T1057,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,28
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1005,No,-,29
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1203,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,27
T1204.001,No,-,28
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1033,No,-,25
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,23
T1018,No,-,24
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1560.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/anomalous_usage_of_7zip.yml,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml,17
T1047,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,17
T1056.001,No,-,22
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,10
T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,10
T1076,No,-,22
T1021.001,No,-,22
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,17
T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,17
T1189,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml,20
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1116,No,-,19
T1553.002,No,-,19
T1049,No,-,19
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1133,No,-,18
T1074.001,No,-,18
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,16
T1112,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml,16
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,6
T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,6
T1087.001,No,-,17
T1543.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml,16
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml,14
T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml,14
T1503,No,-,17
T1555.003,No,-,17
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml,14
T1136.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml,14
T1041,No,-,17
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll32_with_no_command_line_arguments_with_network.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml,7
T1218.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml,7
T1087.002,No,-,16
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,12
T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,12
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml,14
T1505.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml,14
T1085,No,-,16
T1136.002,No,-,16
T1073,No,-,16
T1100,No,-,16
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,14
T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,14
T1574.002,No,-,16
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1063,No,-,15
T1119,No,-,15
T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,14
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,12
T1555,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,12
T1583.001,No,-,15
T1518.001,No,-,15
T1043,No,-,15
T1584.001,No,-,15
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1059.007,No,-,14
T1045,No,-,14
T1036.004,No,-,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,0
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,0
T1027.002,No,-,14
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,12
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1219,No,-,12
T1560,No,-,12
T1102.002,No,-,12
T1012,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1573.001,No,-,11
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,8
T1135,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,8
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,9
T1106,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,9
T1090,No,-,11
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,9
T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,9
T1571,No,-,11
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,2
T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,2
T1059.006,No,-,11
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,9
T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,9
T1035,No,-,11
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1143,No,-,10
T1132.001,No,-,10
T1587.001,No,-,10
T1559.002,No,-,10
T1588.001,No,-,10
T1102,No,-,10
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,9
T1564.003,No,-,10
T1518,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,9
T1173,No,-,10
T1124,No,-,10
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1590.002,No,-,9
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,6
T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,6
T1099,No,-,9
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml,7
T1071.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_record_changed.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,7
T1007,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml,7
T1070.006,No,-,9
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_wevtutil_usage.yml,7
T1070.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_event_log_cleared.yml,7
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,8
T1090.002,No,-,9
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_renamed.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_mshta_url_in_command_line.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_inline_hta_execution.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_child_process.yml,3
T1218.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_mshta_spawn.yml,3
T1583.006,No,-,9
T1170,No,-,9
T1584.006,No,-,9
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_regsvr32_application_control_bypass.yml,7
T1218.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_regsvr32_register_suspicious_path.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/identify_new_user_accounts.yml,7
T1078.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_account_lockouts_from_endpoint.yml,7
T1088,No,-,9
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1066,No,-,8
T1003.004,No,-,8
T1137,No,-,8
T1021.004,No,-,8
T1074.002,No,-,8
T1009,No,-,8
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_created_by_netsh.yml,6
T1562.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/processes_launching_netsh.yml,6
T1027.001,No,-,8
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_log_deletion_via_mimikatz_modules.yml,6
T1070,Yes,https://github.com/splunk/security_content/blob/develop/detections/usn_journal_deletion.yml,6
T1552.001,No,-,8
T1027.005,No,-,8
T1065,No,-,8
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_copy_command_from_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/credential_dumping_via_symlink_to_shadow_copy.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ntdsutil_export_ntds.yml,2
T1003.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/clients_connecting_to_multiple_dns_servers.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_long_dns_txt_record_response.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detection_of_dns_tunnels.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/dns_query_length_with_high_standard_deviation.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_archive_files_http_post_traffic.yml,2
T1048.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/plain_http_post_exfiltrated_data.yml,2
T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,7
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1069,No,-,7
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,3
T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,3
T1071,No,-,7
T1547.009,No,-,7
T1546.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/wmi_permanent_event_subscription___sysmon.yml,6
T1023,No,-,7
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_delete_policy.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_failure_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_successful_group_deletion.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml,-8
T1098,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml,-8
T1195.002,No,-,7
T1570,No,-,7
T1075,No,-,7
T1027.003,No,-,7
T1194,No,-,7
T1221,No,-,7
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,3
T1134,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,3
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,5
T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,5
T1084,No,-,7
T1001.002,No,-,7
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1037,No,-,6
T1574.001,No,-,6
T1040,No,-,6
T1120,No,-,6
T1586.002,No,-,6
T1038,No,-,6
T1550,No,-,6
T1585.002,No,-,6
T1110.003,No,-,6
T1589.002,No,-,6
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,5
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,2
T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,2
T1020,No,-,6
T1015,No,-,6
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,3
T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,3
T1573.002,No,-,6
T1095,No,-,6
T1158,No,-,6
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4
T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,4
T1055.001,No,-,6
T1090.001,No,-,6
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1560.003,No,-,5
T1069.002,No,-,5
T1218.007,No,-,5
T1572,No,-,5
T1071.003,No,-,5
T1583.004,No,-,5
T1021.006,No,-,5
T1568,No,-,5
T1188,No,-,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,4
T1069.001,No,-,5
T1566,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_email___uba_anomaly.yml,4
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_renamed.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_spawn_child_process.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_url_in_command_line.yml,1
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,1
T1090.003,No,-,5
T1001,No,-,5
T1056,No,-,5
T1567.002,No,-,5
T1028,No,-,5
T1499,No,-,5
T1598,No,-,5
T1223,No,-,5
T1213,No,-,5
T1584.004,No,-,5
T1587,No,-,5
T1102.001,No,-,5
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1596.003,No,-,4
T1561.002,No,-,4
T1014,No,-,4
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,3
T1588.004,No,-,4
T1093,No,-,4
T1587.003,No,-,4
T1110.002,No,-,4
T1586.001,No,-,4
T1487,No,-,4
T1091,No,-,4
T1589,No,-,4
T1145,No,-,4
T1552.004,No,-,4
T1003.005,No,-,4
T1036.002,No,-,4
T1497,No,-,4
T1071.002,No,-,4
T1199,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1588.002,No,-,4
T1585.001,No,-,4
T1055.012,No,-,4
T1208,No,-,4
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml,-2
T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml,-2
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,1
T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,1
T1496,No,-,4
T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,3
T1008,No,-,4
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml,2
T1558.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml,2
T1094,No,-,4
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1067,No,-,3
T1557,No,-,3
T1213.002,No,-,3
T1016.001,No,-,3
T1542.003,No,-,3
T1025,No,-,3
T1114.001,No,-,3
T1080,No,-,3
T1497.001,No,-,3
T1115,No,-,3
T1587.002,No,-,3
T1584.003,No,-,3
T1567,No,-,3
T1562.002,No,-,3
T1004,No,-,3
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,2
T1547.004,No,-,3
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0
T1583.003,No,-,3
T1550.003,No,-,3
T1074,No,-,3
T1104,No,-,3
T1072,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,2
T1593,No,-,3
T1097,No,-,3
T1201,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,2
T1573,No,-,3
T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,2
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-4
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-4
T1027.004,No,-,3
T1500,No,-,3
T1555.004,No,-,3
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml,0
T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml,0
T1498,No,-,3
T1098.002,No,-,3
T1588.003,No,-,3
T1003.006,No,-,3
T1053.002,No,-,3
T1529,No,-,3
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1021.005,No,-,2
T1222.002,No,-,2
T1492,No,-,2
T1109,No,-,2
T1568.002,No,-,2
T1594,No,-,2
T1565.001,No,-,2
T1606.002,No,-,2
T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml,1
T1484.002,No,-,2
T1568.001,No,-,2
T1218.004,No,-,2
T1559.001,No,-,2
T1555.005,No,-,2
T1608.004,No,-,2
T1176,No,-,2
T1560.002,No,-,2
T1032,No,-,2
T1087.003,No,-,2
T1218.003,No,-,2
T1483,No,-,2
T1553.006,No,-,2
T1217,No,-,2
T1574.006,No,-,2
T1134.002,No,-,2
T1125,No,-,2
T1589.003,No,-,2
T1542.002,No,-,2
T1191,No,-,2
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_admin_email_forwarding.yml,0
T1114.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_user_email_forwarding.yml,0
T1055.002,No,-,2
T1606.001,No,-,2
T1098.001,No,-,2
T1048.002,No,-,2
T1497.002,No,-,2
T1052.001,No,-,2
T1059.004,No,-,2
T1036.001,No,-,2
T1187,No,-,2
T1001.003,No,-,2
T1550.004,No,-,2
T1506,No,-,2
T1111,No,-,2
T1564.005,No,-,2
T1037.001,No,-,2
T1220,No,-,2
T1480.001,No,-,2
T1118,No,-,2
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1
T1110.001,No,-,1
T1216.001,No,-,1
T1491.002,No,-,1
T1590.005,No,-,1
T1546.013,No,-,1
T1501,No,-,1
T1123,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,0
T1539,No,-,1
T1172,No,-,1
T1527,No,-,1
T1053.003,No,-,1
T1588.006,No,-,1
T1070.002,No,-,1
T1214,No,-,1
T1103,No,-,1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets.yml,-1
T1530,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_open_s3_buckets_over_aws_cli.yml,-1
T1565.003,No,-,1
T1552.002,No,-,1
T1222.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/hiding_files_and_directories_with_attrib_exe.yml,0
T1137.006,No,-,1
T1556.002,No,-,1
T1070.003,No,-,1
T1608.001,No,-,1
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_for_creating_shim_databases.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_file_creation.yml,-2
T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections/shim_database_installation_with_suspicious_parameters.yml,-2
T1010,No,-,1
T1182,No,-,1
T1029,No,-,1
T1608.002,No,-,1
T1547.005,No,-,1
T1484.001,No,-,1
T1183,No,-,1
T1092,No,-,1
T1557.001,No,-,1
T1042,No,-,1
T1101,No,-,1
T1546.012,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_privilege_escalation.yml,0
T1218.008,No,-,1
T1591.002,No,-,1
T1055.013,No,-,1
T1504,No,-,1
T1558.001,No,-,1
T1592.004,No,-,1
T1137.001,No,-,1
T1138,No,-,1
T1546.009,No,-,1
T1553.005,No,-,1
T1568.003,No,-,1
T1608.005,No,-,1
T1134.001,No,-,1
T1205.001,No,-,1
T1528,No,-,1
T1491.001,No,-,1
T1552.006,No,-,1
T1546.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_changes_to_file_associations.yml,0
T1026,No,-,1
T1122,No,-,1
T1102.003,No,-,1
T1534,No,-,1
T1056.002,No,-,1
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,0
T1110.004,No,-,1
T1488,No,-,1
T1174,No,-,1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,-1
T1592.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,-1
T1546.015,No,-,1
T1137.004,No,-,1
T1186,No,-,1
T1030,No,-,1
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-2
T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,-2
T1494,No,-,1
T1090.004,No,-,1
T1557.002,No,-,1
T1493,No,-,1
T1546.010,No,-,1
T1565.002,No,-,1
T1146,No,-,1
T1200,No,-,1
T1556.001,No,-,1
T1543.002,No,-,1
T1590.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,0
T1126,No,-,1
T1137.002,No,-,1
T1550.001,No,-,1
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_setdefaultpolicyversion.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_compute_instance_created_by_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/cloud_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_aws_api_activities_from_unapproved_accounts.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_api_calls_from_user_roles.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_new_user_aws_console_login.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_aws_api_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_spike_in_security_group_activity.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_modified_with_previously_unseen_user.yml,-16
T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/ec2_instance_started_with_previously_unseen_user.yml,-16
T1564.004,No,-,1
T1096,No,-,1
T1056.004,No,-,1
T1001.001,No,-,1
T1561.001,No,-,1
T1211,No,-,1
T1574.012,No,-,1